dcrat | 5af44c8748dfd602affc88b52200f5c0f9c54065876a8de8dddb1e4548793508 | Triage

Sharing

General

Target

5af44c8748dfd602affc88b52200f5c0f9c54065876a8de8dddb1e4548793508.exe
Size

1.8MB
Sample

241117-kyj5hawepf
MD5

ad09440875d20aadffdfdc8de043c448
SHA1

fbfc7d94285b1da7e0799382a40352f827984771
SHA256

5af44c8748dfd602affc88b52200f5c0f9c54065876a8de8dddb1e4548793508
SHA512

e8d80aa2ec81b8b06b2a83e18674e19137b996f405dc4e6c93a3fcf76de0e949cbc333396a22141963043fd55ff9a8711eabd0963b933df58e4438f42706e8a3
SSDEEP

24576:zyvTg4STbYSG65XZsTBsR36Y1864kHFLlb/sgaspAqsbTsIvVJUl52iFxA4Gbgz:W6hdR3KlyFLlbsrs6PbTJU24GbQ

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Targets

- Target
  
  5af44c8748dfd602affc88b52200f5c0f9c54065876a8de8dddb1e4548793508.exe
- Size
  
  1.8MB
- MD5
  
  ad09440875d20aadffdfdc8de043c448
- SHA1
  
  fbfc7d94285b1da7e0799382a40352f827984771
- SHA256
  
  5af44c8748dfd602affc88b52200f5c0f9c54065876a8de8dddb1e4548793508
- SHA512
  
  e8d80aa2ec81b8b06b2a83e18674e19137b996f405dc4e6c93a3fcf76de0e949cbc333396a22141963043fd55ff9a8711eabd0963b933df58e4438f42706e8a3
- SSDEEP
  
  24576:zyvTg4STbYSG65XZsTBsR36Y1864kHFLlb/sgaspAqsbTsIvVJUl52iFxA4Gbgz:W6hdR3KlyFLlbsrs6PbTJU24GbQ
Score

10^/10

dcrat discovery infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerpersistencerat

behavioral2

dcratdiscoveryinfostealerpersistencerat